The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of reading and acting upon data from external issue trackers.
Ingestion points: In both the 'Shine into the territory' and 'Redraw the map' workflows (SKILL.md), the agent is instructed to 'Load the map' and 'Load every open ticket', which includes notes, decisions, and questions written by users or external sources.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between administrative data and potentially malicious instructions embedded within the ticket content.
Capability inventory: The agent has the authority to create, update, claim, and close tickets, and can invoke other sub-agents like /research or tools like /prototype based on the content it processes.
Sanitization: The skill does not define any sanitization, filtering, or validation steps for the external content before it is used to drive agent decisions.

flashlight